A heap‑based buffer overflow (CWE‑122) within Microsoft Windows Media Foundation allows an attacker to execute arbitrary code on a target system. The likely attack vector involves an unauthorized network attacker sending a specially crafted media file or stream to a vulnerable system, as inferred from the description. Once exploited, the attacker can gain full control over the affected machine, compromising confidentiality, integrity, and availability.

Affected Microsoft products include Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2019, 2022, 2025, each in both standard and Server Core installations.

The CVSS score of 8.8 classifies the vulnerability as high, and the exploitability is underscored by its network‑based nature. While an EPSS score is not currently available, the absence of a KEV listing suggests it has not yet been widely used in the wild, yet the flaw remains exploitable by any attacker who can deliver malicious content. A successful attack requires only that the target have Media Foundation enabled and that a crafted media payload be executed, which can occur through remote services or local file abuse.